01 · Status and scope
This policy must follow the final data flow.
This pre-launch draft describes the current Rainbow Runner website code and the availability-form implementation. It is excluded from search indexing while the long-term form recipient, email retention period, hosting-log practices, payment processor, privacy contact process, and legal operating entity remain undecided.
The production policy must be reviewed after those services and business processes are selected. It should not promise practices that have not been implemented or confirmed.
02 · Current preview behavior
The preview transmits a request only after validation.
The availability form validates required fields in the visitor’s browser, sends the entry to a Cloudflare Pages Function, and uses Cloudflare Turnstile to check for automated abuse. The function validates the entry again before attempting email delivery.
Verified current behavior: the form does not write the entry to a website database or browser storage, create an account, or collect a payment. A successful confirmation is shown only after the server reports successful email delivery. Email delivery remains disabled until the sender domain is authorized in Cloudflare.
03 · Information requested
What the availability form asks for.
The current form contains fields for:
- preferred and alternate charter dates, or an indication that dates are flexible;
- number of guests;
- fishing interests, target species, or preferred methods;
- first and last name;
- email address and phone number;
- optional questions or practical notes; and
- agreement to receive communication about that charter request.
The form does not request an account password, government identifier, card number, bank information, or payment details.
04 · Intended use
Booking communication—not a marketing list.
The form is used to let Rainbow Runner respond to a charter inquiry, discuss dates and fishing interests, and confirm trip details. The current consent language covers communication about that request. The configured recipient is a temporary Hawaii Web Solutions inbox and must be changed to the client’s approved inbox before production launch.
If the business later wants to send unrelated marketing messages, collect text-message consent, publish submitted Catch Log material, or use inquiry information for another purpose, the form and this policy must be updated before that use begins.
06 · Third-party services
Cloudflare processes the secured submission.
The site links to third-party sources including Hawaiʻi DLNR, The Maui News, YouTube, Maui Fishing Secrets, and other external articles or media. Following one of those links takes the visitor to a service with its own privacy practices.
The site does not send availability-form fields to those linked sources. Cloudflare processes the form through Pages Functions and Turnstile and, after the sender domain is authorized, Cloudflare Email Service will deliver it to the configured recipient. No payment processor, analytics platform, or separate form database is connected.
07 · Retention and security
Email retention rules still need approval.
The website does not save submissions in a database. After successful delivery, the inquiry is held in the configured recipient’s email system and may also be present in routine Cloudflare security or service logs. The final implementation must establish who can access inquiries, how long email copies are retained, and how they are deleted.
The final policy must also describe the safeguards and service providers actually used. No website or transmission method should be described as completely secure.
08 · Privacy choices
Contact and deletion procedures are still required.
Visitors can avoid entering information in the form and contact Rainbow Runner directly by phone or email. There is no stored website-database record, but a successfully delivered request remains in the recipient’s email system until deleted under the approved retention process.
Before launch, Rainbow Runner must designate a privacy contact and define how a person can request access, correction, or deletion of information held in the selected email, booking, payment, or form-delivery systems.
09 · Contact and changes
Questions about this draft.
Questions can be directed to rainbowrunnercharters@gmail.com or 808-357-6025.
The production version should identify the legal operating entity and privacy contact, show an effective date, and be revised whenever a material data practice or service provider changes.